Authentication

Base URL

All API requests should be made to:

https://api.discolike.com/v1/

OpenAPI Specification

The complete API specification is available at api.discolike.com/v1/openapi.json.

Creating an account from an agent

An AI agent can create the account for its human without a browser: POST /v1/public/signup with the person’s work email and name. The person confirms by email, logs in, and issues keys from the app. See the Agent signup guide for per-agent instructions and the Signup API reference.

API Keys

API keys are the credential for servers, CI, and anything else without a browser. Create and manage your keys at app.discolike.com/account/management/keys.

Include your API key in the x-discolike-key header:

curl "https://api.discolike.com/v1/discover?keyword=fintech" \
  -H "x-discolike-key: YOUR_API_KEY"

Note

All API keys for the same account share rate limits.

OAuth Bearer Tokens

Every /v1/* route also accepts an OAuth 2.1 access token in the Authorization header. This is what the CLI and Python SDK use after discolike auth login, and the same server the MCP integration authenticates against.

curl "https://api.discolike.com/v1/discover?keyword=fintech" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Tokens are issued by the authorization server described at api.discolike.com/v1/.well-known/oauth-authorization-server, through the authorization-code flow with PKCE. Public clients register dynamically and use the offline_access scope to receive a refresh token. The protected-resource metadata at api.discolike.com/.well-known/oauth-protected-resource/v1 names the resource the token must be issued for, https://api.discolike.com/v1, which is what a client passes as the resource parameter when authorizing and exchanging the code.

Bearer support on the REST routes is live on the development environment and reaches production with the next platform release; before that, production accepts bearer tokens on /v1/mcp only.

When more than one credential is present, the platform checks them in this order and uses the first that applies: an app web session, then the Authorization: Bearer header, then x-discolike-key. An invalid or expired bearer token returns 401 with Invalid API Key or Session; a valid token whose account is not a DiscoLike tenant returns 403.